Dumping a multigames 1050 in 1 NES Cartridge with INLretro

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

nes356
Posts: 24
Joined: Sat Nov 19, 2022 10:11 am

Dumping a multigames 1050 in 1 NES Cartridge with INLretro

Post by nes356 »

How to dump this multi-games NES cartridge with the INLretro cartridge dumper ?

The game menu occupies more than 16 KB, so probably 32KB.
This cartridge contains UNROM games (Contra...) and other types.
It contains the game Bubble Bobble.

Photos of the PCB (front and back mirror) :

Image
Image

Recent technical datas :

http://krzysiobal.com/carts/?action=view&id=12

Image
Image
Attachments
120in1-contra-1992.nes
(512.02 KiB) Downloaded 49 times
sch.png
top-tracks.jpg
pcb1050in1-verso-miroir-8.jpg
pcb1050in1-recto-5.jpg
Last edited by nes356 on Mon Mar 27, 2023 9:23 am, edited 3 times in total.
lidnariq
Posts: 11429
Joined: Sun Apr 13, 2008 11:12 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

A significant portion of how this board works has been hidden inside the program inside the TIBPAL16L8. Assuming someone else doesn't specifically recognize this board, you'll need to ask the INLretro to dump it as though it were NROM, and hopefully there'll be enough information in that NROM dump to figure out how to dump the cartridge.

Additionally, this is a multicart that detects when the CPU is in reset with that resistor+diode+capacitor. You'll have to modify that to be able to dump the cartridge on anything less than a CopyNES.
nes356
Posts: 24
Joined: Sat Nov 19, 2022 10:11 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

Code: Select all

./inlretro -s scripts/inlretro2.lua -c NES -m nrom -x 32 -y 8 -d 1000in1-nrom-PRG32kb-CHR8kb.nes
Attachments
1000in1-nrom-PRG32kb-CHR8kb.nes
(40.02 KiB) Downloaded 88 times
Last edited by nes356 on Thu Jan 19, 2023 10:43 am, edited 2 times in total.
lidnariq
Posts: 11429
Joined: Sun Apr 13, 2008 11:12 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

Based on the code in the "-x 32" nrom dump, it looks like there's a register is at $Exxx. Based on the schematic, there's only one register.

Use this script ("decipher.lua") with "-x 4096". This dump will not work, but it will let us determine what the PAL is doing.

You must also short out this
pcb1050in1-capacitor-to-short.jpg
pcb1050in1-capacitor-to-short.jpg (22.18 KiB) Viewed 3634 times
capacitor, or else this script will not work.
Attachments
decipher.zip
(1.35 KiB) Downloaded 51 times
nes356
Posts: 24
Joined: Sat Nov 19, 2022 10:11 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

By shorting the capacitor with an electric wire (continuity is ok with a voltmeter) and replacing the nrom.lua script by the decipher.lua script that you give (in the scripts/nes directory of INLretro program), the result is :

Code: Select all

root@a:~/INL-retro-progdump-master/host# ./inlretro -s scripts/inlretro2.lua -c NES -m nrom -x 4096 -y 8 -d 1000in1-nrom-PRG_4096kb-CHR_8kb-decipher.nes

Successfully found and connected to INL retro-prog
Device firmware version: 2.3.x 
Permitted Error with opcode: GET_APP_VER operand: 0 misc: 0 device error code: 138
WARNING!! Device's return data length:  0       did not match expected: 1
firmware app ver request:       0
firmware is out of date, recommend updating

Dumping PRG-ROM...
[ERROR] (source/inlprog.c:370: errno: Resource temporarily unavailable) cannot run config. file: ./scripts/app/nes.lua:23: bad argument #1 to 'char' (value out of range)
Fatal error encountered, exiting.

Code: Select all

root@a:~/INLRetro/INL-retro-progdump-master/host# ./inlretro -s scripts/inlretro2.lua -c NES -m nrom -x 2048 -y 8 -d 1000in1-nrom-PRG_2048kb-CHR_8kb-decipher.nes

Successfully found and connected to INL retro-prog
Device firmware version: 2.3.x 
Permitted Error with opcode: GET_APP_VER operand: 0 misc: 0 device error code: 138
WARNING!! Device's return data length:  0       did not match expected: 1
firmware app ver request:       0
firmware is out of date, recommend updating

Dumping PRG-ROM...
[ERROR] (source/inlprog.c:370: errno: Resource temporarily unavailable) cannot run config. file: ./scripts/app/nes.lua:49: attempt to perform bitwise operation on a nil value (local 'mapper')
Fatal error encountered, exiting.
Last edited by nes356 on Thu Jan 19, 2023 10:52 am, edited 1 time in total.
lidnariq
Posts: 11429
Joined: Sun Apr 13, 2008 11:12 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

replace "-m nrom" with "-m decipher310331C". And "decipher.lua" probably has to be copied into the same directory as "nrom.lua" is in (in the dumper program)
nes356
Posts: 24
Joined: Sat Nov 19, 2022 10:11 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

Several things have been changed in the INLretro scripts for the decipher.lua script can work :

In the local function write_header(file, prgKB, chrKB, mapper, mirroring) of the script scripts/app/nes.lua :

Code: Select all

		file:write(string.char(prgKB / 16))
has been replaced by :

Code: Select all

		file:write(string.char(255))
(NB : 4096 / 16 = 256 => the value of a char goes from 0 to 255 => Error : bad argument #1 to 'char' (value out of range))

and the line below has been added :

Code: Select all

		mapper=0
(NB : the value of the variable mapper was "nil" so it caused an error (mapper=0 is the value for nrom mapper))

In the script scripts/inlretro2.lua :
A line to refer to the decipher.lua script has been added in the variable that contains the list of mappers :

Code: Select all

	    local mappers = {
			...
        	decipher = require "scripts.nes.decipher",
	    }
Finally :

Code: Select all

./inlretro -s scripts/inlretro2.lua -c NES -m decipher -x 4096 -d 1000in1-decipher-PRG_4096kb.nes
generated the dump file below (it has been truncated because it exceeded the size limit of 4Mb for attachments on this forum) :
Attachments
1000in1-decipher-PRG_4096kb-truncated.nes
(4 MiB) Downloaded 71 times
Last edited by nes356 on Thu Jan 19, 2023 11:08 am, edited 2 times in total.
lidnariq
Posts: 11429
Joined: Sun Apr 13, 2008 11:12 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

From Krzysiobal's schematic, the discrete logic on the PCB already does this following:

Code: Select all

A~[111x xxxx xxIH W???] D~[?MGF E???]
               || |         ||| |
               ++------------++-+---- Specify PRG A21 downto A17
                  |         +-------- H/V nametable arrangment
                  +------------------ CHR RAM write protect

Here's what I've learned from the above dump:

The PAL rounds out the behavior to the following:

Code: Select all

A~[111x xxxx xxIH WXmm] D~[AMGF EDCB]
               || ||||     |||| ||||
               ++----------+-++-++++- Specify A21("I") downto A13("A"), when appropriate
                  ||||      +-------- still H/V nametables
                  |+++--------------- 0,4: 32K PRG, 1: UNROM (128K), 2,6: 8K PRG (use "B" and "A" bits), 3,7: 16K PRG (use "B" bit), 
                  |                   5: stupid 32K mode (ignore ABCD, treat C and D as 1, pass through CPU A13 and CPU A14)
                  +------------------ still CHR RAM write protect
As such, the three attached dumping scripts should all produce the same result, each using a different way to ask for it.

The size to request is only 3MiB, "-x 3072". There is no CHR ROM, so you can leave out "-y".
Attachments
dump310331C.zip
(4.03 KiB) Downloaded 50 times
nes356
Posts: 24
Joined: Sat Nov 19, 2022 10:11 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

Code: Select all

INLretro program error : the -x option must be non-zero power of 2, 16kb or greater.
solved by :

Code: Select all

./inlretro -s scripts/inlretro3.lua -c NES -m dump310331c -x 4096 -d 1000in1-dump310331C-16-PRG_4096kb.nes

cp 1000in1-dump310331C-16-PRG_4096kb.nes 1000in1-dump310331C-16-PRG_3072kb.nes

truncate -s 3145744 1000in1-dump310331C-16-PRG_3072kb.nes

#### NB : 16 (header) + 3 MB (3072 x 1024) = 3145744 bytes
char(192) have been put in the header of the generated file for the rom PRG size (192x16 = 3072 kb)

As anticipated, the 3 scripts has given the same result :
Attachments
1000in1-dump310331C-16-PRG_3072kb.nes
(3 MiB) Downloaded 70 times
Last edited by nes356 on Thu Jan 19, 2023 12:47 pm, edited 5 times in total.
zxbdragon
Posts: 498
Joined: Mon Dec 12, 2011 8:15 pm

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by zxbdragon »

The data is valid for 512K, and it seems that 1024K data is missing
Attachments
32423434_002.png
32423434_002.png (6.83 KiB) Viewed 3321 times
32423434_001.png
32423434_001.png (6.29 KiB) Viewed 3321 times
lidnariq
Posts: 11429
Joined: Sun Apr 13, 2008 11:12 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

... UGH I see one of my mistakes in my code, but I don't see the other.
I had

Code: Select all

                local datapart = (read_count & 7) << 1;
                local addrpart = 0xE000 | ((read_count << 1) & 0x30);
                dict.nes("NES_CPU_WR", addrpart, datapart)      --32KB @ CPU $8000
but I forgot to include all the bits.

That should have been:

Code: Select all

                local datapart = (read_count & 31) << 1;
                local addrpart = 0xE000 | ((read_count >> 1) & 0x30);
That said, I still don't see why the original dump repeated 6 times after 512K instead of 3 times after 1M.
nes356
Posts: 24
Joined: Sat Nov 19, 2022 10:11 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

By running the script with the 2 corrective lines suggested and setting the mapper to 15 (the only that seems to work) in the header, the dump file generated is :
Attachments
1000in1-dump310331C-32-2-PRG_3072kb-1.nes-mapper15.nes
(3 MiB) Downloaded 78 times
Last edited by nes356 on Thu Jan 19, 2023 12:52 pm, edited 8 times in total.
lidnariq
Posts: 11429
Joined: Sun Apr 13, 2008 11:12 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

The first 2MiB have unique content, but the third MiB is a copy of the first. I must still have some mistake in my code, but I am not entirely clear where...
User avatar
krzysiobal
Posts: 1036
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by krzysiobal »

Looking at the font from main menu, I bet i saw something similar before.

After a few minutes I found out I rev-en something like that before:
I think this might be the same mapper.

viewtopic.php?p=222458

BTW. Why google stopped indexing forums.nesdev.org so well after moving from .com to .org?
After entering "250-in-1 multicart / similar to Contra 168-in-1/100-in 1" it shows only one result from archive.nes.science and nothing from this site.
Image My website: http://krzysiobal.com | Image My NES/FC flashcart: http://krzysiocart.com
Fiskbit
Posts: 890
Joined: Sat Nov 18, 2017 9:15 pm

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by Fiskbit »

krzysiobal wrote: Fri Nov 25, 2022 12:31 pm BTW. Why google stopped indexing forums.nesdev.org so well after moving from .com to .org?
After entering "250-in-1 multicart / similar to Contra 168-in-1/100-in 1" it shows only one result from archive.nes.science and nothing from this site.
Unfortunately, because the archive is older than nesdev.org, Google treats it as the primary source and nesdev.org as the duplicate.
Post Reply